Secure Boot Violation 0 FIX

[Logoschmitt]

HP OMEN 30L Secure Boot Issue

I am having a Secure Boot issue on an HP OMEN 30L Desktop GT13-1xxx (ROM Family/SSID 8876) running BIOS F.24.

Secure Boot is currently disabled. When I enable Secure Boot in the BIOS and save the changes, the computer fails to boot and displays:

“Secure Boot Violation – Invalid signature detected. Check Secure Boot Policy in Setup.”

I originally cleared the Secure Boot keys while troubleshooting, but I have since verified through Administrator PowerShell that all of the required Secure Boot databases are present:

• PK (Platform Key): Present
• KEK (Key Exchange Key): Present
• db (Allowed Signature Database): Present
• dbx (Forbidden Signature Database): Present

Confirm-SecureBootUEFI still reports False when Secure Boot is disabled.

I have also already rebuilt the Windows UEFI boot files successfully using:

mountvol S: /S
bcdboot C:\Windows /s S: /f UEFI
mountvol S: /D

Windows boots normally when Secure Boot is disabled.

I also attempted HP BIOS recovery using Windows + B, but the recovery screen did not appear.

I attempted to investigate rolling back the BIOS from F.24 to F.19, but HP's official F.19 installer explicitly states:

“You cannot downgrade the BIOS to previous versions once the BIOS is upgraded since there is a security update and important fixes for system functionality.”

Therefore, the downgrade is blocked by HP.

At this point, the issue appears to be related to BIOS F.24's Secure Boot implementation/signature validation on the HP OMEN 30L 8876 platform, rather than missing Secure Boot keys or corrupted Windows boot files.

What I need help determining:
Whether there is a safe way to repair/reinitialize Secure Boot on BIOS F.24, or whether this is a known F.24 firmware bug that requires an HP BIOS update/patch. I do not want to force-flash an older BIOS or use modified firmware if it could brick the motherboard.

Like am i screwed until you guys update something??? its been months dude.. im about to give up and throw HP out the window... you guys are a million dollar company !

[Ekiisp · Accepted solution]

I managed to fix it on my OMEN with BIOS F.24.

In my case, Secure Boot had worked before, but after disabling it and restoring the factory Secure Boot keys, the system started showing “Secure Boot Violation / Invalid signature detected” whenever Secure Boot was enabled.

The problem was that the firmware database had fallen back to the old 2011 certificates and was missing Windows UEFI CA 2023.

What fixed it:

Boot Windows with Secure Boot disabled.
Check that this file exists:
C:\Windows\Boot\EFI\SecureBootRecovery.efi
Prepare a USB drive as FAT32.
Create this folder structure on the USB:
\EFI\BOOT\
Copy:
C:\Windows\Boot\EFI\SecureBootRecovery.efi
to:
\EFI\BOOT\BOOTX64.EFI
Boot the USB in UEFI mode from the HP boot menu.
Microsoft Secure Boot Recovery should start and display something similar to:
“Updating the Secure Boot Certificate database with the Microsoft UEFI 2023 certificate”
Let it complete and reboot.
Go back into the BIOS and enable Secure Boot again.

After that, Windows booted normally.

I verified it with PowerShell:

Confirm-SecureBootUEFI

Result:

True

And:

([Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).Bytes) -match "Windows UEFI CA 2023")

Result:

True

One important detail: the USB must be FAT32. Mine was initially exFAT and the HP UEFI boot menu would not detect it.

Also, I would avoid using Clear Secure Boot Keys / Load HP Factory Default Keys again after fixing it, because that may restore the old certificate set.

[Bill_To]

Greetings @Ekiisp 

Very nice.

Kudos!

Regards

[UrkelGrue]

https://h30434.www3.hp.com/t5/Gaming-Desktops/OMEN-30L-GT13-1xxx-Secure-Boot-Violation-with-Secure-B...

Can confirm that this fixed the issue. I have Secure Boot enabled, no error message, and the COD Attestation program passed. Thanks so much for finding a solution!